The install link that skips the store entirely

The message says the app is not on the store yet, or that this is the beta, or that your region does not have it. Tap here to install directly. The page looks like a store page — screenshots, a rating, a description — and the button says Install.

An install link is any link that delivers an app to your device directly rather than through the official store, and it is not automatically fraudulent. There are legitimate reasons for one to exist. But it removes the review, the signing checks and the automatic updates that make store apps relatively safe, and the fraudulent version relies on people not knowing what was removed.

What the store actually does for you

The store provides four protections, and an install link skips all four at once.

• Review before publication. Imperfect, and still a filter. Apps that obviously steal credentials or hide their purpose are caught at a meaningful rate.
• A signature tied to an identified developer. Someone accountable is attached to the binary, which matters when something goes wrong.
• A permission model the user can inspect. The listing declares what data the app collects, and the system prompts for sensitive access at runtime.
• Updates, including removal. An app found to be malicious is pulled and, in some cases, disabled on devices. Sideloaded apps receive nothing.

The store is not a guarantee. It is a filter, an identity, and a way to be un-installed later. An install link outside it discards all three.

That third item is the one people underestimate. When a bad app is discovered on a store, there is a mechanism to stop it spreading and often to disable it. A sideloaded app has no such path — it stays until the user removes it, and they do not know to.

The legitimate reasons a link exists

A legitimate install link does exist, and being fair about that is what makes the fraudulent case recognisable.

Beta testing. Official beta programmes are normal, and they run through the platforms' own systems — TestFlight on iOS, testing tracks on Android. A beta invitation that does not go through those is not a beta.

Enterprise distribution. Organisations distribute internal apps to their own staff through a management system that the device is enrolled in. If you are not an employee being onboarded by your own IT department, this does not apply to you.

Open-source and independent distribution on Android. Android permits installing from other sources by design, and there are reputable alternative stores. This is a real, legitimate ecosystem — and it is also the reason the attack is far more common on Android than on iOS.

Regional availability. An app genuinely unavailable in your country. The honest answer here is usually that it is unavailable for a reason, not that a link is the solution.

What the fraudulent version asks for

A fraudulent install link makes specific requests, and each one is a decision point.

Install a configuration profile. On iOS this is the main mechanism, and it is powerful: a profile can add certificates, route traffic, restrict settings and install apps. Any unsolicited request to install one should be refused outright. Legitimate profiles come from your employer or your school, in a context where you already knew it was coming.

Enable installing from unknown sources. On Android this toggle exists for good reasons and is also the gate the attack needs open. If a page asks you to change a security setting to proceed, the setting is the target.

Trust a developer certificate. Going into settings to mark an unknown developer as trusted is an explicit act of granting permission to something you cannot identify.

Grant accessibility permissions after install. This is the most dangerous request on Android, because accessibility access allows an app to read the screen and act on it. An app asking for it without a clear accessibility purpose is asking to see everything you type.

That last request is the one worth refusing reflexively. It is the difference between an app that misbehaves and an app that watches your banking session.

Why the page looks so convincing

Because it costs nothing to copy. Screenshots, ratings, review counts, a description in the platform's typography — all of it is a web page, and a web page can look like anything.

Three tells that survive a good imitation:

It is a website, not the store app. Real store listings open in the store application. If tapping the link keeps you in a browser with an Install button on the page, that is not a store.

The URL is not the platform's. Read it right to left: the domain is the last two parts before the first single slash. apps.apple.com.download-ios.net belongs to download-ios.net.

The flow includes a step the real one does not have. Installing from the real store never requires you to change a setting, trust a certificate, or install a profile.

The middle one is the same discipline that applies to any link, and it is worth practising on the ones that do not matter so it is automatic on the ones that do — the same habit covered in suspicious links.

If you already installed something

If you followed an install link and installed something, order matters, and the first step is not the obvious one.

1. Delete the app, and on iOS also remove any configuration profile it installed — Settings, General, VPN & Device Management. The profile is the part people leave behind.
2. Check for a VPN configuration you did not add, since a profile can route all your traffic somewhere.
3. Revoke accessibility and admin permissions on Android before uninstalling, because an app with device admin rights can resist removal.
4. Change passwords for anything you used while it was installed, from a different device, prioritising email and banking.
5. Check your accounts for sessions you do not recognise and sign them out.
6. Restart the device, then look again — some apps hide their icon but remain in the app list.

Step three is the one that traps people: an app granted device administrator rights cannot be deleted normally, and the sequence is to revoke first, then remove.

For anything involving money, contact the bank rather than waiting to see what happens, and mention specifically that a device may have been compromised — it changes how they treat subsequent transactions.

More on link inspection in suspicious links, impersonation of official channels in impersonation, and general device hygiene in digital safety. Apple documents configuration profiles and Google covers Google Play Protect if you want the mechanics.

The short version

An install link outside the store removes review, developer identity, the declared permission model, and the ability to have a bad app disabled later. Some links are legitimate — official beta programmes, employer distribution, known open-source projects — and they never arrive unsolicited with a deadline.

Refuse any request to install a configuration profile, enable unknown sources, trust an unknown developer, or grant accessibility permissions. And remember that a store page you reach in a browser is not a store page: the real one opens the store app, and installing from it never asks you to change a setting first.